{"id":"CVE-2024-14033","aliases":["EUVD-2024-55531","GHSA-jxwc-xxjw-356x"],"status":"published","title":"Hirschmann EagleSDV Denial of Service via TLS","description":"Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00438,"percentile":0.38375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122","CWE-400"],"published":"2026-04-02T20:40:37Z","modified":"2026-07-24T21:10:00Z","products":[{"vendor":"belden","product":"hirschmann eaglesdv"}],"references":[{"url":"https://assets.belden.com/m/774d24c02be5c220/original/Belden_Security_Bulletin_BSECV-2024-16.pdf","tags":["vendor-advisory"]},{"url":"https://www.vulncheck.com/advisories/hirschmann-industrial-it-hilcos-heap-overflow-dos","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14033"},{"url":"https://ssd-disclosure.com/ssd-advisory-lancom-lcos-heap-overflow"},{"url":"https://www.belden.com/security"},{"url":"https://github.com/advisories/GHSA-jxwc-xxjw-356x"}],"sources":{"cve":[{"id":"CVE-2024-14033","title":"Hirschmann EagleSDV Denial of Service via TLS","description":"Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability.","status":"published","published":"2026-04-02T20:40:37.469Z","modified":"2026-05-25T23:41:26.609Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-55531","description":"Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability.","status":"published","published":"2026-04-02T20:40:37Z","modified":"2026-05-25T23:41:26Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:21:08.174412Z"}],"ghsa":[{"id":"GHSA-jxwc-xxjw-356x","title":"Hirschmann Industrial IT products contain a heap overflow vulnerability in the HiLCOS web...","description":"Hirschmann Industrial IT products contain a heap overflow vulnerability in the HiLCOS web interface that allows unauthenticated remote attackers to trigger a denial-of-service condition by sending specially crafted requests to the web interface. Attackers can exploit this heap overflow to crash the affected device and cause service disruption, particularly in configurations where the Public Spot functionality is enabled.","status":"published","published":"2026-04-02T21:32:53Z","modified":"2026-04-04T00:31:26Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122","CWE-400"],"updated_at":"2026-11-02T15:07:09.038762Z"}],"nvd":[{"id":"CVE-2024-14033","description":"Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1, interrupting service availability.","status":"published","published":"2026-04-02T21:16:39.863Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:47.77313Z"}]}}